~ / search / GHSA-3jw2-5hjg-hc2c

GHSA-3jw2-5hjg-hc2c

Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-64133

Packages

EcosystemPackageAffectedFixed in
Maven jp.ikedam.jenkins.plugins:extensible-choice-parameter <= 239.v5f5c278708cf no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to execute sandboxed Groovy code. As of publication of this advisory, there is no fix.

References

External links from the advisory. They lead to third-party sites.